AOSSIE-Org / AOSSIE-Org/Template-Repo

[FEATURE]: Add Wildcard/Auto-Discovery Support for Dependabot Configuration

Open
#72 3 comments 0 reactions 0 assignees View on GitHub
enhancement planned
Dominant language
YAML
Stars
17
Forks
29
Avg merge
3d 13h
Merged PRs (30d)
6

Description

### Feature and its Use Cases

Dependabot currently requires maintainers to manually configure each package-ecosystem and its corresponding directory in the dependabot.yml file.

This creates maintenance challenges, especially in repositories with multiple services or monorepo structures. Whenever:

- A new package ecosystem is introduced
- A new subdirectory is added
- The project structure changes

the configuration file must be manually updated.

If directories or ecosystems are not explicitly added to dependabot.yml, Dependabot will not monitor or update dependencies in those locations. This increases the risk of missed updates and adds ongoing maintenance overhead.

Current Manual Approach Example:
```yaml
- package-ecosystem: "npm"
directory: "/" # Must manually change to "/frontend", "/backend", etc.
```

think around this:

1. Wildcard Directory Support
Allow wildcards in directory specification to automatically discover all matching paths:
```
- package-ecosystem: "npm"
directory: "/*" # Auto-discover all directories with package.json
# OR
directory: "**/packages/*" # Glob pattern for monorepos
```

2. Auto-Discovery Mode
Enable Dependabot to automatically detect which package ecosystems are actually present:
```
version: 2
updates:
- auto-discover: true # Automatically detect all package ecosystems
directory: "/**" # Search entire repository
# Common settings apply to all discovered ecosystems:
schedule:
interval: "weekly"
labels:
- "dependencies"
```
resources:
- https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference

- https://github.com/dependabot/dependabot-core/issues/2178#issuecomment-1321161917
(also consider https://github.com/Makeshift/generate-dependabot-glob-action/issues/44)

### Additional Context

Example Use Case
A monorepo with the following structure:

/
├── frontend/package.json
├── backend/package.json
├── services/api/package.json
├── services/worker/package.json
└── mobile/pubspec.yaml

Current approach: Requires 4 separate npm blocks + 1 pub block (5 total sections)
With wildcards: 1 npm block with directory: "**/package.json" pattern + 1 pub block (2 total sections)

### Code of Conduct

- [x] I have joined the [Discord server](https://discord.gg/hjUhu33uAn) and will post updates there
- [x] I have searched existing issues to avoid duplicates

Contributor guide

Open the contributing guide

Research direction

Start by reading the Dependabot options reference and the linked Dependabot issue, then compare the proposed wildcard and auto-discovery syntax with the monorepo example. The issue names no repository files or tests; done would require an agreed design, implementation location, and validation approach for the new configuration behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
github
Domain
devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.